Bill 51 creates a framework that requires prescribed Manitoba public‑sector entities to govern their use of artificial intelligence systems and to implement cybersecurity programs under rules set by regulation. The Act directs entities to establish accountability frameworks, manage AI risk, meet technical standards, and in certain cases provide information to the public and assign individual oversight of AI uses.
The bill matters because it centralizes how provincial and local public bodies must deploy AI and protect digital systems: it authorizes regulation‑making (including adopting external codes by reference), gives the minister authority to issue directives tailored to specific entities, and builds in public consultation and a mandated review of regulations. For compliance officers and IT leaders, the statute sets the legal basis for forthcoming mandatory obligations and procurement requirements — but leaves many operational details to the regulations and ministerial directives.
At a Glance
What It Does
Bill 51 requires prescribed public sector entities to follow regulatory requirements for the use of artificial intelligence systems and cybersecurity, including developing accountability frameworks, conducting risk and impact assessments, and complying with technical standards. The minister may also issue entity‑specific directives (with Lieutenant Governor in Council approval) and regulations may prohibit certain AI uses.
Who It Affects
Applies to public sector entities that the regulations prescribe — the explanatory note lists examples such as government departments, health authorities, universities, school divisions and municipalities. It also reaches AI that is public, developed or procured by the entity, or developed by a third party on the entity’s behalf.
Why It Matters
The Act establishes the provincial legal authority to impose standardized requirements across a diverse set of public bodies and to incorporate external codes and standards by reference, shifting many AI and cybersecurity governance choices from local policy to provincial regulation and ministerial oversight.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Act sets out definitions, scope and purpose and then delegates the detailed obligations to regulation and ministerial direction. Rather than spelling out operational rules in the statute, it creates duties for “prescribed” public sector entities to meet standards and follow regulatory requirements for artificial intelligence use and cybersecurity.
The text highlights transparency, accountability and risk management as core goals: entities will be required to supply information about AI use when regulations demand it, to create accountability frameworks, and to take steps to detect and mitigate bias and other risks.
For AI specifically, the law covers systems that are publicly available, developed or procured by the entity, or created by third parties for the entity. In certain prescribed circumstances the Act requires a named individual to exercise oversight and to provide additional information about AI use.
The regulations can set which entities are covered, what information must be published and how accountability frameworks must be documented, including required impact and risk assessments and bias‑testing measures.On cybersecurity, the Act requires prescribed entities to implement cybersecurity programs and meet technical standards. The regulations may require incident reporting, defined response and recovery measures, education and awareness, and oversight mechanisms.
The minister may issue directives tailored to a specific entity’s cybersecurity requirements, and the directives must be made public in whatever manner the minister chooses.Regulatory power is broad: the Lieutenant Governor in Council and the minister may prescribe who is covered, set technical standards, and adopt external codes or standards by reference (including automatic updates). The Act requires public consultation on proposed regulations except in urgent circumstances and mandates a formal evaluation of any regulation within three years of coming into force, with the minister required to table the evaluation report in the Assembly.
The Five Things You Need to Know
The minister may issue entity‑specific cybersecurity directives, but only with Lieutenant Governor in Council approval; those directives can set different standards for different entities.
Regulations can explicitly prohibit specified AI uses — the Act even lists as an example banning production of artistic or creative material using AI.
Regulatory powers allow adopting external codes or standards by reference and to accept those codes as amended over time, effectively delegating technical detail to non‑statutory standards.
The Act requires a review of any regulation within three years and mandates the minister to table the evaluation report on the first 15 sitting days after receiving it.
Failure to comply with the Act or a directive does not invalidate existing policies, instruments or decisions — the statute contains an express non‑invalidity clause rather than civil penalties or automatic remedies.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Definitions and statutory purpose
These opening sections define key terms — notably “artificial intelligence system,” “cybersecurity,” “minister,” and “public sector entity” — and set the Act’s purpose as creating a transparent, accountable AI and cybersecurity regulatory framework. The statutory definitions are broad (for example, AI covers machine‑based systems that infer outputs) and the inclusion of a ‘‘prescribed’’ mechanism signals that the operational scope will largely be set by regulation rather than in the statute itself.
Scope: who and what the Act covers
Section 3 limits application to public sector entities and to AI systems that the regulations cover; it expressly applies to AI that is publicly available, developed or procured by the entity, or built by third parties for the entity. The provision also contains two control valves: a conflict clause saying other enactments prevail, and a non‑invalidity clause that preserves the legal effect of decisions even if the Act’s requirements are later found unmet.
AI governance obligations and technical standards
These sections impose substantive governance obligations if the regulations require them: providing information to the public about AI use, developing accountability frameworks, managing risks, complying with prescribed technical standards, and avoiding uses that regulations prohibit. The minister and LGIC will define when these duties kick in, how detailed documentation must be, who within an entity is responsible, and what bias‑testing and impact assessments are required.
Cybersecurity programs and ministerial directives
The Act requires prescribed entities to implement cybersecurity programs and meet technical standards that regulations specify. It also empowers the minister, with LGIC approval, to issue directives to particular entities; those directives can differ between entities and are binding on the targeted entity. The statute requires the minister to publish directives, but gives the minister discretion about the publication method.
Regulation‑making power and public process
Section 10 is the operational heart: it lists granular regulatory topics for AI and cybersecurity, permits differential application across classes of entities, allows adopting external codes or standards by reference (including automatic updates), and requires public consultation on proposed regulations except in urgent cases. The section also requires a regulatory effectiveness review within three years and mandates tabling that report in the Assembly.
Citations and commencement
The final sections give the Act a chapter reference in the statute book and provide that the law comes into force on proclamation. That defers timing and allows the government to craft accompanying regulations and directives before the Act becomes operative.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Manitobans who use public services — by design the Act aims to increase transparency about when and how AI affects services and decisions, which helps users understand and challenge automated outcomes.
- Privacy and civil‑society groups — the statutory focus on accountability frameworks, bias testing and public information gives advocates defined points to assess and push for stronger safeguards.
- IT and cybersecurity teams in larger agencies — the Act creates a clear provincial standard and a legal basis for seeking funding or authority to implement enterprise‑wide cybersecurity measures and formalize incident reporting.
Who Bears the Cost
- Prescribed public sector entities (departments, health authorities, municipalities, school divisions) — they must design and maintain accountability frameworks, perform impact assessments, meet technical standards, and produce reports, which creates organizational and budgetary burdens.
- Third‑party vendors and contractors supplying AI or cybersecurity services — procurement terms, documentation and technical standard requirements will likely become mandatory contract conditions, raising compliance costs and contractual complexity.
- Small municipalities and smaller public bodies — entities with limited IT and procurement capacity will face proportionally higher administrative and implementation costs to meet province‑wide standards and reporting obligations.
Key Issues
The Core Tension
The central dilemma is between centralized risk control and operational flexibility: the Act centralizes authority to protect the public (uniform technical standards, mandatory impact testing, and ministerial directives) yet relies on regulation and ministerial discretion rather than statute to define obligations — a trade‑off that delivers standardization and rapid adaptability at the cost of immediate clarity, democratic oversight, and predictable compliance burdens.
The Act is deliberately skeletal: it creates obligations but pushes nearly all operational detail into regulations and ministerial directives. That design speeds legislative passage and preserves flexibility, but it leaves stakeholders unsure about key compliance thresholds — which entities will be “prescribed,” what precise technical standards will look like, and what enforcement (if any) will follow non‑compliance.
Another implementation issue is the mix of transparency and security. The Act requires public information and mandates public consultation on regulations, yet it also empowers the minister to publish directives in any manner the minister chooses and allows exemptions from information requirements.
Balancing meaningful transparency about automated decision‑making against legitimate cybersecurity and privacy constraints will require detailed regulatory drafting and clear guidance to practitioners.
Finally, the power to adopt external codes and to accept their automatic amendment reduces legislative friction but raises questions about democratic oversight and alignment with Canadian or international standards. The three‑year review requirement helps, but much depends on how quickly and transparently the government exercises those regulatory powers and funds compliance for affected entities.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.